.\" DO NOT MODIFY THIS FILE! It was generated by help2man 1.47.4. .TH REKALL "1" "December 2016" "rekall 1.6.0" "User Commands" .SH NAME rekall - memory forensics framework .SH SYNOPSIS rekall [options] .SH DESCRIPTION Rekall Framework is a completely open collection of tools, implemented in Python under the Apache and GNU General Public License, for the extraction and analysis of digital artifacts computer systems. Rekall supports investigations of the following 32bit and 64bit memory images: Microsoft Windows XP Service Pack 2 and 3 Microsoft Windows 7 Service Pack 0 and 1 Microsoft Windows 8 and 8.1 Microsoft Windows 10 Linux Kernels 2.6.24 to 4.4. OSX 10.7-10.12.x. .SS "optional arguments:" .TP \- A do nothing arg. Useful to separate options which take multiple args from positional. Can be specified many times. .SS "Output control:" .TP \fB\-v\fR, \fB\-\-verbose\fR Set logging to debug level. .TP \fB\-q\fR, \fB\-\-quiet\fR Turn off logging to stderr. .TP \fB\-\-debug\fR If set we break into the debugger on error conditions. .TP \fB\-\-output_style\fR {concise,full} How much information to show. Default is 'concise'. .TP \fB\-\-logging_level\fR {DEBUG,INFO,WARNING,ERROR,CRITICAL} The default logging level. .TP \fB\-\-log_domain\fR [{PageTranslation} [{PageTranslation} ...]] Add debug logging to these components. .TP \fB\-\-plugin\fR [PLUGIN [PLUGIN ...]] Load user provided plugin bundle. .TP \fB\-h\fR, \fB\-\-help\fR Show help about global parameters. .TP \fB\-\-cache\fR CACHE Type of cache to use. .TP \fB\-\-repository_path\fR [REPOSITORY_PATH [REPOSITORY_PATH ...]] Path to search for profiles. This can take any form supported by the IO Manager (e.g. zip files, directories, URLs etc) .TP \fB\-f\fR FILENAME, \fB\-\-filename\fR FILENAME The raw image to load. .TP \fB\-\-buffer_size\fR BUFFER_SIZE The maximum size of buffers we are allowed to read. This is used to control Rekall memory usage. .TP \fB\-\-output\fR OUTPUT If specified we write output to this file. .TP \fB\-\-max_collector_cost\fR MAX_COLLECTOR_COST If specified, collectors with higher cost will not be used. .TP \fB\-\-home\fR HOME An alternative home directory path. If not set we use $HOME. .TP \fB\-\-logging_format\fR LOGGING_FORMAT The format string to pass to the logging module. .TP \fB\-\-performance\fR {normal,fast,thorough} Tune Rekall's choice of algorithms, depending on performance priority. .TP \fB\-\-live\fR LIVE Enable live memory analysis. .TP \fB\-o\fR FILE_OFFSET, \fB\-\-file_offset\fR FILE_OFFSET A Relative offset for image file. .TP \fB\-\-cache_dir\fR CACHE_DIR Location of the profile cache directory. .TP \fB\-\-highlighting_style\fR {manni, igor, lovelace, xcode, vim, autumn, vs, rrt, native, perldoc, borland, tango, emacs, friendly, monokai, paraiso\-dark, colorful, murphy, bw, pastie, algol_nu, paraiso\-light, trac, default, algol, fruity} Highlighting style for interactive console. .TP \fB\-\-pagefile\fR [PAGEFILE [PAGEFILE ...]] A pagefile to load into the image. .TP \fB\-\-version\fR Prints the Rekall version and exits. .SS "Interface:" .TP \fB\-\-pager\fR PAGER The pager to use when output is larger than a screen full. .TP \fB\-\-paging_limit\fR PAGING_LIMIT The number of output lines before we invoke the pager. .TP \fB\-\-colors\fR {auto,yes,no} Color control. If set to auto only output colors when connected to a terminal. .TP \fB\-F\fR FORMAT, \fB\-\-format\fR FORMAT The output format to use. Default (text) .TP \fB\-\-timezone\fR TIMEZONE Timezone to output all times (e.g. Australia/Sydney). .HP \fB\-\-name_resolution_strategies\fR [{Module,Symbol,Export} [{Module,Symbol,Export} ...]] .SS "Autodetection Overrides:" .TP \fB\-\-dtb\fR DTB The DTB physical address. .TP \fB\-\-autodetect_build_local_tracked\fR [AUTODETECT_BUILD_LOCAL_TRACKED [AUTODETECT_BUILD_LOCAL_TRACKED ...]] When autodetect_build_local is set to 'basic' we fetch these modules directly from the symbol server. .TP \fB\-\-autodetect\fR {linux_index,nt_index,tsk,osx,pe,windows_kernel_file,rsds,ntfs,linux} [{linux_index,nt_index,tsk,osx,pe,windows_kernel_file,rsds,ntfs,linux} ...] Autodetection method. .TP \fB\-\-autodetect_threshold\fR AUTODETECT_THRESHOLD Worst acceptable match for profile autodetection. (Default 1.0) .TP \fB\-\-autodetect_build_local\fR {full,basic,none} Attempts to fetch and build profile locally. .TP \fB\-\-autodetect_scan_length\fR AUTODETECT_SCAN_LENGTH How much of physical memory to scan before failing .SS "Virtualization support:" .TP \fB\-\-ept\fR EPT [EPT ...] The EPT physical address. .PP When no module is provided, drops into interactive mode